U-M Researchers Expose Open Port Vulnerabilities on Android Apps

Most security experts are aware of “wormhole” apps, popular Android apps with open ports that allow an attacker to remotely exploit a mobile device, but a new study from the University of Michigan (U-M) found that more Android apps are vulnerable to security breaches than previously thought.

For the study, the U-M team designed OPAnalyzer, a static analysis tool that can identify and characterize vulnerable open port usage in Android apps. The researchers used the tool to examine more than 100,000 Android apps and found that 99 percent of mobile usage of open ports takes place for the following five reasons:

Data Sharing: A usage path through which data from a device is sent to the remote host. The researchers found that HTTP is the most commonly used protocol for data sharing. Nearly 60 percent of data sharing paths do not require any client authentication.

Proxy: A path used to forward remote input requests to other destinations. Commonly used for advertising and content filtering, a proxy path can lead to DDoS attacks.

Remote execution: Used to trigger specific actions, such as sending an SMS message. Many app developers have left “backdoors” for this path type.

VoIP: Used in apps to listen on incoming call requests, VoIP paths can be used to spoof caller IDs — making phishing attempts more achievable.

PhoneGap: Paths on apps developed by Gap/Cordova, which serve JavaScript requests from the client and handle API calls. However, the U-M researchers determined these are mostly secured.

Traditional solutions to protect an open port from online threats call for firewalls, but “the firewall solution suffers from usability in the mobile context,” according to the report. In other words, it can be difficult for individual users to configure suitable firewall rules on top of everything else.